Commit 6b7332eb authored by Markus Armbruster's avatar Markus Armbruster Committed by Gerd Hoffmann
Browse files

qxl: Slot sanity check in qxl_phys2virt() is off by one, fix 



Spotted by Coverity.

Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 515aa3c5

hw/qxl.c

+1 −1
Original line number Diff line number Diff line
@@ -1020,7 +1020,7 @@ void *qxl_phys2virt(PCIQXLDevice *qxl, QXLPHYSICAL pqxl, int group_id) 
    case MEMSLOT_GROUP_HOST:

        return (void*)offset;

    case MEMSLOT_GROUP_GUEST:

        PANIC_ON(slot > NUM_MEMSLOTS);

        PANIC_ON(slot >= NUM_MEMSLOTS);

        PANIC_ON(!qxl->guest_slots[slot].active);

        PANIC_ON(offset < qxl->guest_slots[slot].delta);

        offset -= qxl->guest_slots[slot].delta;